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Abstract. In this talk, we describe two recent developments in quantum 
algorithms. 

The first new development is a quantum algorithm for evaluating a 
Boolean formula consisting of AND and OR gates of size N in time 
0(\/iV). This provides quantum speedups for any problem that can be 
expressed via Boolean formulas. This result can be also extended to span 
problems, a generalization of Boolean formulas. This provides an opti- 
mal quantum algorithm for any Boolean function in the black-box query 
model. 

The second new development is a quantum algorithm for solving systems 
of linear equations. In contrast with traditional algorithms that run in 
time 0(A^'''^ ■■) where A'' is the size of the system, the quantum algo- 
rithm runs in time 0{\og'^ N). It outputs a quantum state describing the 
solution of the system. 



1 History of quantum algorithms 
1.1 First quantum algorithms 

Quantum computing (and, more broadly, quantum information science) is a 
new area at the boundary of computer science and physics. It studies how to 
apply quantum mechanics to solve problems in computer science and information 
processing. The area of quantum computing was shaped by the discoveries of two 
major quantum algorithms in mid-1990s. 

The first of the these two discoveries was Shor's polynomial time quantum 
algorithm for factoring and discrete logarithms. Factoring and discrete loga- 
rithm are very hard number theoretic problems. The difficulty of these problems 
has been used to design cryptosystems (such as RSA and DifBe-Helman key ex- 
change) for secure data transmission over an insecure network (such as Internet). 
The security of data transmission is based on the assumption that it is hard to 
factor (or find discrete logarithm of) large numbers. Until recently, this assump- 
tion was not in doubt. Mathematicians had tried to devise an efficient way of 
factoring large numbers for centuries, with no success. 

In 1994, Shor [5B] discovered a fast algorithm for factoring large numbers - on 
a quantum mechanical computer. This shook up the foundations of cryptography. 
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If a quantum mechanical computer is built, today's methods for secure data 
transmission over the Internet will become insecure. 

Another, equally strikingly discovery was made in 1996, by Lov Grover |34j . 
He invented a quantum algorithm for speeding up exhaustive search problems. 
Grover's algorithm solves a generic exhaustive search problem with N possible 
solutions in time 0{\/N). This provides a quadratic speedup for a range of search 
problems, from problems that are in P classically to NP-complete problems. 

Since then, each of the two algorithms has been analyzed in great detail. 
Shor's algorithm has been generalized to solve a class of algebraic problems that 
can be abstracted to Abelian hidden subgroup problem [39]. Besides factoring 
and discrete logarithm, the instances of Abelian HSP include cryptanalysis of 
hidden linear equations [18j . solving Pell's equation, principal ideal problem [35) 
and others. 

Grover's algorithm has been generalized to the framework of amplitude am- 
plification [21' and extended to solve problems like approximate counting [23I47[ 
and collision- finding j22j. 

1.2 Quantum walks and adiabatic algorithms 

Later, two new methods for designing quantum algorithms emerged: quantum 
walks [4|41|9|54|60] and adiabatic algorithms [3T[ . 

Quantum walks are quantum generalizations of classical random walks. They 
have been used to obtain quantum speedups for a number of problems. The 
typical setting is as follows. Assume that we have a classical Markov chain, 
on a state-space in which some states are special (marked). The Markov chain 
starts in a uniformly random state and stops if it reaches a marked state. If the 
classical Markov chain reaches a marked state in expected time T, then there is a 
quantum algorithm which can find it in time 0{\/T), assuming some conditions 
on the Markov chain [58|44|42j . 

This approach gives quantum speedups for a number of problems: element 
distinctness [5], search on a grid [13159] . finding triangles in graphs [IS], testing 
matrix multiplication I19J and others. 

Another application of quantum walks is to the "glued trees" problem [25] . 
In this problem, we have a graph G with two particular vertices u, v, designed 
as the entrance and the exit. The problem is to find the vertex v, if we start at 
the vertex u. There is a special exponential size graph called "glued trees" on 
which any classical algorithm needs exponential time to find v but a quantum 
algorithm can find v in polynomial time [26] . 

Adiabatic computation is a physics-based paradigm for quantum algorithms. 
In this paradigm, we design two quantum systems: 

— Hsoi whose lowest-energy state {ipsoi) encodes a solution to a computational 
problem (for example, a satisfying assignment for SAT). 

— H start whose lowest-energy state \^pstart) is such that we can easily prepare 

lip start)- 



We then prepare \'4' start) and slowly transform the forces acting on the quantum 
system from H start to Hsoi ■ Adiabatic theorem of quantum mechanics guarantees 
that, if the transformation is slow enough, \4'start) is transformed into a state 
close to \tpsoi) PT] , 

The key question here is: what is "slowly enough"? Do we need a polynomial 
time or an exponential time to transform Hgtart to Hsoi (thus solving SAT by a 
quantum algorithm)? This is a subject of an ongoing debate [31I29I2| . 

Adiabatic computation has been used by D-Wave Systems j30] which claims 
to have built a 128-bit adiabatic quantum computer. However, the claims of 
D-Wave have been questioned by many prominent scientists (see e.g. [T]). 

1.3 Most recent algorithms 

Two most recent discoveries in this field are the quantum algorithms for for- 
mula evaluation [32] and solving systems of linear equations . Both of those 
algorithms use the methods from the previous algorithms but do it in a novel, 
unexpected way. Formula evaluation uses quantum walks but in a form that is 
quite different from the previous approach (which we described above) . Quantum 
algorithm for formula evaluation uses eigenvalue estimation |46| which is the key 
technical subroutine of Shor's factoring algorithm |56| and the related quantum 
algorithms. But, again, eigenvalue estimation is used in a very unexpected way. 

These two algorithms are the main focus of this survey. We describe them in 
detail in sections [5] and [31 

2 Formula evaluation 
2.1 Overview 

We consider evaluating a Boolean formula of variables xi , . . . , x^r consisting of 
ANDs and ORs, with each variable occuring exactly once in the formula. Such a 
formula can be described by a tree, with variables Xi at the leaves and AND / OR 
gates at the internal nodes. This problem has many applications because Boolean 
formulas can be used to describe a number of different situations. The most 
obvious one is determining if the input data xi, . . . , xat satisfy certain constraints 
that can be expressed by AND/OR gates. 

For a less obvious application, we can view formula evaluation as a black- 
box model for a 2-player game (such as chess) if both players play their optimal 
strategies. In this case, the game can be represented by a game tree consisting of 
possible positions. The leaves of a tree correspond to the possible end positions 
of the game. Each of them contains a variable Xi, with xi = 1 if the 1^' player 
wins and Xi = Q otherwise. If an internal node v corresponds to a position in 
which the I*'* player makes the next move, then v contains a value that is OR 
of the values of w's children. (The f*' player wins if he has a move that leads 
to a position from which he can win.) If w is a node for which the 2"^^ player 
makes the next move, then v contains a value that is AND of the values of v^s 



children. (In this case, the 1*** player wins if he wins for any possible move of the 
2'^'^ player.) 

The question is: assuming we have no further information about the game 
beyond the position tree, how many of the variables Xi do we have to examine 
to determine whether the 1''* player has a winning strategy? 

Classically, the most widely studied case is the full binary tree of depth d, 
with N = 2'^ leaves. It can be evaluated by looking at 0{N-'^^'^---) leaves and this 
is optimal |54I53I57] . A natural question was whether one could achieve a better 
result, using quantum algorithms. This question was a well known open problem 
in the quantum computing community since mid-1990s. Until 2007, the only 
known result was that fl{\/N) quantum steps are necessary, for any AND-OR 
tree [3TT4] . 

2.2 The model 

By standard rules from Boolean logic (de Morgan's laws), we can replace both 
AND and OR gates by NAND gates. A NAND gate NAND{yi, ...,yk) outputs 
1 if AND{yi, . . . ,y)S) = (i.e., yi = for at least one i € {!,..., fc}) and 
otherwise. Then, we have a tree with xi, . . . , ccjv at the leaves and NAND gates 
at the internal vertices. The advantage of this transformation is that we now 
have to deal with just one type of logic gates (instead of two - AND and OR). 

We work in the quantum query model. In the discrete-time version of this 
model |6I20) . the input bits xi, . . . , xat can be accessed by queries O to a black 
box. 

To define O, we represent basis states as |i, z) where i G {0, 1, . . . , N}. The 
query transformation Ox (where x — (xi, . . . , xat)) maps |0, z) to |0, z) and \i, z) 
to {—\Y^\i,z) for i e {1, A^} (i.e., we change phase depending on Xi, unless 
i = in which case we do nothing). 

Our algorithm can involve queries and arbitrary non-query transforma- 
tions that do not depend on xi, . . . ,XAr. The task is to solve a computational 
problem (e.g., to compute a value of a NAND formula) with as few queries as 
possible. 

2.3 Results 

In 2007, in a breakthrough result, Farhi et al. [32] showed that the full binary 
AND-OR tree can be evaluated in 0{yfN) quantum time in continuous-time 
counterpart of the query model. 

Several improvements followed soon. Ambainis et al. |27I8I12| translated the 
algorithm of |32| to the conventional discrete time quantum query model and ex- 
tended it to evaluating arbitrary Boolean formulas with 0(A^^/^+°(^)) quantum 
queries. 

Soon after, Reichardt and Spalek [52] discovered a far-reaching generalization 
of this result. Namely, the quantum algorithm was generalized to evaluating 
span programs. A span program is an algebraic model of computation, originally 
invented for proving lower bounds on circuit size [40j . 



In a span program, we have a target vector v in some linear space. We also 
have other vectors wi, . . . ,Wm, each of which is associated with some condition 
Xi — OT Xi — 1. The span program evaluates to 1 on an input xi,. . . ,Xn if 
V is equal to a linear combination of vectors , . . . , Vi^, which are associated 
with conditions that are true for the given input xi, . . . , x„. Otherwise, the span 
program evaluates to 0. 

Here is an example of a span program. We have a two dimensional linear 
space, with the following vectors: 




where a, &, c are any three distinct non-zero numbers. Vectors vi,V2, W3 are asso- 
ciated with conditions xi = 1, a;2 = 1, 2:3 = 1, respectively. 

Given any two of vi,V2,V3, we can express any vector in two dimensions 
(including v) as their linear combination. Thus, this span program computes the 
majority function MAJ{xi, X2, X3) which is 1 whenever at least 2 of variables 
Xi,X2,X3 are equal to 1. 

Logic formulae can be embedded into span programs. That is, if we have two 
span programs computing functions . . . , xjv) and f2{xi, . . . , xn), we can 

combine them into span programs for /i AND /2 and /i OR /2 in a fairly simple 
way. 

Reichardt and Spalek |52) invented a complexity measure, witness size for 
span programs. This measure generalizes formula size: a logic formula of size 
S can be transformed into a span program with witness size S. |52j gave a 
quantum algorithm for evaluating a span program of witness size S with 0(75) 
queries. This is a very interesting result because it allows to evaluate formulas 
with gates other than AND and OR by designing span programs for those gates 
and them composing them into one big span program. The next step was even 
more interesting. 

The next step was even more surprising. Reichardt |48|49|51] discovered that 
the span program approach is optimal, for any Boolean function /(xi, . . . ,xn). 
That is [51] ■ if Q{f) is the minimum number of quantum queries for evaluating 
/ (by any quantum algorithm), then there is a span program with witness size 
0((5^(/)). Thus, a span-program based algorithm can evaluate / with 0{Q{f)) 
queries, within a constant factor of the best possible number of queries. 

This fact linked two lines of research: quantum formula evaluation algorithms 
and "quantum adversary" lower bounds. "Quantum adversary" (invented in [3]) 
is a method for proving lower bounds on the number of queries to evaluate 
/(xi, . . . ,XAr) by a quantum algorithm. Several progressively stronger versions 
of "quantum adversary" have been invented |7I15I43I3"5] , with the strongest being 
the "negative adversary" method of [38] , 

Finding the best lower bound for quantum algorithms provable via "nega- 
tive adversary" method is a semidefinite program (SDP). Reichardt [48149151] 
considered the dual of this SDP and showed that the dual SDP gives the span 
program with the smallest witness size. Thus, the span programs are optimal 



(in terms of query complexity) for any Boolean function f{xi, . . . , xn)- (Finding 
the optimal span program, however, requires solving a semidefinite program of 
size 2^.) 

As a by-product, this gave a better algorithm for formula evaluation, improv- 
ing the complexity from 0(iVi/2+°(i)) in [12] to 0{^/N\ogN) in [50,. 



2.4 Algorithmic ideas 

We now give a very informal sketch the simplest version of formula evaluation 
algorithm. We augment the formula tree with a finite "tail" of length L as shown 
in Figure [H We then consider a quantum walk on this tree. At the leaves of the 
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Fig. 1. A formula tree augmented with a finite "tail" 



tree, the transformations that are performed depend on whether the leaf holds 
Xi — or Xi ~ 1. (This is achieved by querying the respective Xi and then 
performing one of two transformations, depending on the outcome of the query.) 

The starting state is an appropriately chosen quantum state {ipstart) = J2i Q^j K) 
consisting of the states \i) in the tail. If the quantum walk is set up prop- 
erly, an amazing thing happens! Whenever the formula evaluates to 0, the state 
I'fpstart) remains almost unchanged. Whenever the formula evaluates to 1, after 
(9(7V^/^+°(^)) steps, the state is almost completely different from \^pstart)- This 
means that we can distinguish between the two cases by running the walk for 
0(7V^/^+°(^)) steps and measuring whether the state is still \ipstart)- Surprisingly, 
the behaviour of the walk only depends on the value of the formula and not on 
which particular variables xi, . . . , xn are 1. 

The algorithm for evaluating span programs is essentially the same, except 
that the quantum walk is performed on a weighted graph that corresponds to 
the span program. 

For more information on this topic, we refer the reader to the survey [lO^ and 
the original papers. 



3 Linear equations 



3.1 Overview 

Solving large systems of linear equations is a very common problem in scientific 
computing, with many applications. We consider solving a system of N linear 
equations with N unknowns: Ax = b where 
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A and b are given to us. The task is to find x. 

The best classical algorithm for solving a general system Ax = b runs in time 
Q(^]\f2.37...y rpj^g reason for that was that even outputting the solution requires 
time f2{N) because the solution contains values for N variables. Thus, it seemed 
that there was no hope for achieving more than a polynomial speedup by a 
quantum algorithm. 

Recently, Harrow, Hassidim and Lloyd |36) discovered a surprising quantum 
algorithm that allows to solve systems of linear equations in time 0(log^ N) - in 
an unconventional sense. Namely, the algorithm of [36J generates the quantum 
state 

N 
1=1 

with the coefficients Xi being equal to the values of variables in the solution 
X = {xi,X2, . ■ ■ ,xn) of the system Ax — b. 

What can we do with this quantum state? We cannot extract all the values Xi 
from it. If we measured this state, we would obtain one value i, with probabilities 
of different i proportional to \xi\'^. 

We can, however, estimate some quantities that depend on all of Xi. For 
example, if all variables in the solution had values 1 or -1, having the quan- 
tum state li/j) would enable us to estimate the fraction of variables xt = — 1. 
Moreover, similar tasks appear to be hard classically. As shown by [33], a clas- 
sical 0(log'^ A'^)-time algorithm for computing any quantity of this type implies 
a polynomial time classical algorithm for simulating any quantum computation. 
Thus (unless P=BQP), this quantum algorithm provides a genuine speedup over 
the classical algorithms. 

3.2 More details 

In more detail, the running times of both classical and quantum algorithms for 
solving systems of linear equations actually depend on several parameters. One 
parameter is iV, the number of equations (and variables). Another parameter is 
K, the condition number of the system, k is defined as ^""^ where Umm and Umax 
are the smallest and the largest singular values of the matrix A [37l Chapter 5.8]. 



Intuitively, the condition number describes the closeness of the matrix A to 
a singular matrix. For a singular matrix, iirnin — and n — co. Larger condition 
number means that the matrix A is closer to a singular matrix. In this case, 
small changes to input data A and b (or small numerical inaccuracies) can cause 
large changes to solution x. To compensate, if we have a matrix A with large k, 
we have to perform the computation with a higher accuracy. This increases the 
running time of all algorithms for solving systems of linear equations but the 
exact increase varies greatly from algorithm to algorithm. 

The main classical algorithms for solving systems of linear equations are: 

1. LU-decomposition Chapter 3] which runs in time 0(N^^^''^^■■■ log'^(K)) 
[24] . Here, w = 2.376... is the constant from the running time 0{N'^) of the 
best matrix multiplication algorithm |28) . 

2. Conjugate gradient |33| Chapter 10], which runs in time 0{m^/K) [55] where 
m is the number of non-zero entries in the matrix. If we know that each row 
of A contains at most s non-zero entries, this is at most 0{N s^/H). 

The running time of the quantum algorithm [36] is 0{k^T log'' N) where T is 
the time necessary to implement the transformation e^^ on a quantum computer. 
T varies greatly, depending on A. For sparse A with at most s nonzero values in 
each row and each column, T — 0{s^ log A^) 16 . Thus, in this case the running 
time of the quantum algorithm is O {k^s^ log'' N). This achieves an exponential 
speedup for the case when N is large and k is relatively small (e.g., k — 0(1) or 
K = 0{\ogN)). 

The key bottleneck is the dependence on k which is actually worse than in 
the classical algorithms. We have been able to improve it to 0(k-'^+°^^) log*^ N) 
jllj . Unfortunately, further improvement is very unlikely. |36j have shown that 
an 0{k^~'^ log'' N) time quantum algorithm would imply BQP=PSPACE. 

For non-sparse A, one could use the algorithms of [25 17 to simulate e^^. The 
dependence on N is better than 0{N^'^'^^ ' ) in the classical LU decomposition 
but the speedup is only polynomial. 
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